⚡ electrical engineering

Chameleon: Recovering Cyber-Physical Systems from Memory Corruption Attacks via ML Surrogates

Chameleon is a novel framework that ensures the continuous operation of safety-critical cyber-physical systems under memory corruption attacks by automatically replacing compromised components with secure, machine learning-based surrogates that closely replicate original behavior.

Original authors: Mohsen Salehi, Karthik Pattabiraman

Published 2026-07-03

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Mohsen Salehi, Karthik Pattabiraman

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine your robot drone or self-driving car is like a highly skilled pilot flying a plane. This pilot is running on a computer chip, following a strict set of instructions written in code. Unfortunately, the language used to write this code (C or C++) is a bit like an old, leaky bucket; it has holes where "memory corruption" attacks can slip in. A hacker can poke a hole in the bucket, pour in bad instructions, and hijack the pilot, causing the plane to crash or fly off a cliff.

The Problem with Current Defenses
Right now, most security guards for these robots have a very simple reaction: if they see a hacker poking a hole, they immediately pull the emergency brake and shut the whole plane down.

The Issue: For a robot in the middle of a rescue mission or a delivery, stopping completely is a disaster. It's like telling a surgeon to drop their scalpel and stop operating the moment they see a speck of dust.
Other attempts: Some systems try to reboot the whole plane (which takes too long) or replace the hacked part with a "dummy" part that just says "I don't know" or returns a default value. This is like replacing a skilled surgeon with a mannequin that just holds the scalpel still; the surgery fails, and the patient (or mission) is lost.

The Solution: Chameleon
The researchers propose a new system called Chameleon. Think of Chameleon as a magical "backup pilot" that can instantly take over if the main pilot gets hacked.

Here is how it works, using a few analogies:

1. The "Compartments" (Dividing the Work)

Instead of treating the robot's brain as one giant, messy room, Chameleon divides it into small, organized compartments. Imagine the robot's software is a large office building. Instead of having one security guard watch the whole building, Chameleon puts a guard in every single office (compartment). Each office handles a specific task, like "reading the GPS" or "controlling the motors."

2. The "Surrogate" (The Smart Clone)

Before the robot even takes off, Chameleon does some homework. It watches the robot fly safely in a simulator and records exactly how each office behaves. It then trains a Machine Learning (ML) Surrogate for each office.

The Analogy: Imagine you have a master chef (the original code) who cooks a complex dish. You watch them cook 1,000 times and train a robot chef (the Surrogate) to mimic their every move.
The Key Difference: The original chef uses sharp knives and hot stoves (low-level code with memory holes). The robot chef uses pre-measured ingredients and a microwave (mathematical calculations). The robot chef can't be "stabbed" or "hijacked" in the same way because it doesn't use the dangerous tools the hacker needs.

3. The "Switch" (Instant Recovery)

When the robot is flying and a hacker tries to break into the "GPS office":

Detection: The security guard (using existing tools) spots the break-in.
The Swap: Instead of shutting down the plane, Chameleon instantly fires the hacked chef and swaps them out for the Robot Chef (Surrogate).
The Result: The Robot Chef continues cooking the dish (flying the plane) almost exactly as the original chef would have, but because the Robot Chef is made of math, the hacker can't break in again. The mission continues without a hitch.

What They Found

The researchers tested this on seven different robots (both real ones and simulated ones). Here is what happened:

Accuracy: The Robot Chefs were incredibly good at mimicking the real chefs. They got the job done with 96% accuracy (measured by a score called R²).
Success Rate: When hackers attacked, the robots using Chameleon successfully finished their missions, landing within a safe distance of their target (about 8 meters off).
Comparison:
- No Protection: The robots crashed or flew wildly off course.
- Old Method (Gecko): The robots tried to use a "default value" (like a mannequin). They failed every single mission, landing far away from the target.
- Chameleon: Successfully recovered from the attacks.
Cost: The system was very light. It only slowed the robots down by about 8.5% and didn't make the software much bigger.

The Bottom Line

Chameleon is like having a magic backup pilot that is immune to the specific tricks hackers use to break the main pilot. When an attack happens, it doesn't stop the show; it just swaps the vulnerable actor with a safe, math-based double who knows the lines perfectly. This keeps the robot flying safely even when under attack.

Technical Summary: Chameleon

Problem Statement

Cyber-physical systems (CPSs), particularly robotic vehicles (RVs), are increasingly deployed in safety-critical environments but remain vulnerable to memory corruption attacks (e.g., buffer overflows) due to their reliance on C/C++. When an attacker exploits these vulnerabilities to hijack control flow, existing defense mechanisms typically respond by terminating the process or halting execution. While effective for security, this response is unacceptable for CPSs where continuous operation is required; abrupt termination can lead to catastrophic physical failures (e.g., a drone crashing mid-flight).

Current resilience techniques face fundamental limitations:

Physical Recovery: Techniques designed for sensor spoofing do not address software memory corruption.
Redundancy: Running multiple instances (software or hardware) incurs high overhead and fails if all instances share the same underlying vulnerability.
Rebooting/Default Values: Rebooting causes unacceptable downtime, while replacing compromised components with simplified versions returning default values (e.g., the "Gecko" approach) degrades system behavior, often leading to mission failure.
Coarse-Grained ML: Existing machine learning (ML) approaches treat the entire system as a blackbox, limiting recovery to replacing the whole system and losing fine-grained state variables necessary for mission completion.

Methodology: Chameleon

Chameleon is a framework designed to automatically recover CPSs from memory corruption attacks by replacing compromised software compartments with ML-based surrogates that replicate their behavior without inheriting their vulnerabilities. The system operates in four phases, with the first three executed offline and the final phase at runtime.

1. Compartmentalization & Instrumentation

Chameleon partitions the firmware into task-level compartments (groups of closely related functions) using a Program Dependence Graph (PDG). This granularity balances the need for behavioral accuracy against performance overhead. The firmware is instrumented to:

Monitor inter-compartment transitions.
Enforce Control Flow Integrity (CFI) and Data Flow Integrity (DFI) within compartments.
Trigger the recovery mechanism upon attack detection.

2. Automated Dataflow Analysis

To train accurate surrogates without manual developer effort, Chameleon employs an automated Chameleon Identifier. This component uses static analysis to identify:

Entry and Exit Functions: Determined by analyzing call instructions and data flow across compartment boundaries.
Input/Output Variable Sets: Identifies variables used but not defined (inputs) and values propagated outside the function (outputs), along with CPS state variables (e.g., velocity, position).

3. Data Collection & Offline Training

Data Collection: The instrumented firmware is run in benign environments (simulated and real) across diverse missions. A logger records time-series data of the identified input/output variables and CPS state variables.
Surrogate Construction: The collected data is processed using a sliding window to create sequential datasets. Long Short-Term Memory (LSTM) neural networks are trained to approximate the mapping between input sequences and output sequences for each compartment. LSTMs are chosen for their ability to model temporal dependencies and non-linearities in CPS dynamics.
Optimization: Hyperparameters (layers, hidden units) are tuned via cross-validation to ensure the models are lightweight enough for resource-constrained devices while maintaining high fidelity.

4. Runtime Monitoring & Recovery

At runtime, the Chameleon Monitor (implemented as an LLVM pass) continuously checks for CFI/DFI violations.

Detection: Upon detecting a memory corruption attack (e.g., a control-flow hijack), the monitor identifies the compromised compartment.
Recovery: The compromised compartment is isolated and disabled. The system immediately switches to the pre-trained ML surrogate for that specific compartment. The surrogate receives the current input and state variables, predicts the outputs, and feeds them back into the system.
Security: Since the surrogate consists of arithmetic operations on fixed-size tensors (no pointer arithmetic or dynamic memory allocation), it is structurally immune to the original memory corruption vulnerabilities, preventing the attacker from maintaining control flow hijacking.

Key Contributions

Compartment-Level ML Surrogates: A novel technique for training ML surrogates at the compartment granularity, enabling the replacement of only compromised components rather than the entire system, thereby preserving fine-grained functionality.
Automated Dataflow Analysis: An automated method to identify input-output variable sets and state variables for each compartment, eliminating the need for manual specification by developers.
Chameleon Framework: A portable implementation using the LLVM compiler that integrates compartmentalization, automated analysis, and ML-based recovery, allowing CPSs to recover from attacks without hardware modifications or system reboots.
Comprehensive Evaluation: Validation on seven robotic vehicles (four simulated, three real) running ArduPilot and PX4 firmware, demonstrating effectiveness against realistic memory corruption attacks.

Results

The evaluation of Chameleon across diverse scenarios and missions yielded the following results:

Behavioral Fidelity: The generated surrogates closely approximate original compartment behavior, achieving an average $R^2 = 0.96$ and a Mean Absolute Error (MAE) of 0.20. Specific state variables like Velocity and Yaw showed $R^2$ scores of 0.9995 and 0.9997, respectively.
Mission Recovery: Under attack scenarios, Chameleon successfully recovered all five tested missions. The mean deviation from the target destination was 7.9 meters, well within the 10-meter success threshold (accounting for GPS uncertainty).
Comparison with Baselines:
- Gecko: Replacing compromised components with default values resulted in mission failures for all five tests, with a mean deviation of 48.4 meters (6 $\times$ worse than Chameleon).
- No Protection: Systems without recovery failed to complete missions, with mean deviations of 271 meters.
Efficiency: Chameleon incurred an average CPU overhead of 8.5% and a firmware size overhead of approximately 9% on real RVs. Crucially, the system satisfied all real-time constraints with no deadline misses.

Significance

The paper claims that Chameleon represents the first attack recovery technique that automatically generates behaviorally equivalent ML surrogates at the compartment level to recover CPSs from memory corruption attacks. Its significance lies in shifting the paradigm from "detect and terminate" to "detect and recover," ensuring that safety-critical systems can continue their missions with minimal deviation even when compromised. By leveraging the structural differences between low-level code (vulnerable to memory corruption) and ML inference (arithmetic operations on fixed tensors), Chameleon provides a resilient recovery mechanism that does not require redundant hardware or manual intervention, addressing a critical gap in current CPS security defenses.